Google Issues Security Fix for Actively Exploited Chrome V8 Zero-Day Vulnerability

Google has released security updates for Chrome to address two flaws, including one that has been actively exploited in the wild, according to the NIST National Vulnerability Database (NVD). The vulnerability is CVE-2025-13223 (CVSS 8.8), a type confusion flaw in the V8 JavaScript and WebAssembly engine that could allow arbitrary code execution or cause a crash.

Clément Lecigne of Google's Threat Analysis Group (TAG) is credited with discovering and reporting the flaw on 12 November 2025, and Google has not disclosed who is behind the attacks, their targets, or the scale of the activity, though it acknowledged an exploit exists in the wild. With this update, Google has addressed seven zero‑day flaws in Chrome that have been actively exploited or demonstrated as PoCs since the start of the year, including CVE-2025-13223, CVE-2025-6554 and CVE-2025-10585, among others.

CVE-2025-13224, another type confusion vulnerability in V8, was also patched as part of this release, and it was flagged by Google's AI agent Big Sleep. Users are advised to update Chrome to versions 142.0.7444.175/176 for Windows and Linux or 142.0.7444.175 for macOS, and to restart via More > Help > About Google Chrome, with similar fixes expected for other Chromium-based browsers.